Malicious PDF — malware analysis report

Static analysis result for SHA-256 e16b08d91c347947…

MALICIOUS

PDF

157.3 KB Created: 2021-03-19 11:36:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 151508c562eb26ce4971cfaf8131ca3e SHA-1: 99ea9bc162ee722005e4f481d1abd15177d8b171 SHA-256: e16b08d91c3479477612c1772a8f7e5dad833f2f6ef4b943310b7fdfc18d2dbd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious. It contains an embedded URI pointing to a suspicious domain, likely intended for phishing. While no scripts were directly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=mircea+eliade+pdf
    • https://static.s123-cdn-static.com/uploads/4385038/normal_5ffa94e97394e.pdf
    • https://cdn.sqhk.co/nakunadubux/gdnxbe7/30208341690.pdf
    • https://cdn-cms.f-static.net/uploads/4459337/normal_603af1804fb61.pdf
    • https://cdn.sqhk.co/zuxazutiri/5TibGja/21385744730.pdf
    • https://cdn.sqhk.co/gobenebovi/j6ic7ic/49742199404.pdf
    • https://static.s123-cdn-static.com/uploads/4413004/normal_5ffb3bd215a32.pdf
    • https://cdn.sqhk.co/xadeviro/dNjiaig/download_zombie_frontier_sniper_mod_apk_android_1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a72b158e-cead-41d6-a0b3-8518216316a4.filesusr.com/ugd/35c6e2_980e0a3ff42c4b5dab92e80882bb3c09.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1c4e02da-7e8f-439a-9817-ae390037be25/61962489273.pdf
    • https://uploads.strikinglycdn.com/files/1c61aa5a-1f58-4d89-89c9-0eae41226113/vodopiraxalunelila.pdf
    • https://uploads.strikinglycdn.com/files/78cdf995-12fd-460d-ac4f-de0207dca7f7/rv_fridge_not_cooling_on_gas.pdf
    • https://uploads.strikinglycdn.com/files/155e17ff-3628-4b0a-862f-de4a0f69066e/17485138988.pdf
    • https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_64dc36ce3c2c4625bbb546a0fb864823.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2dfe3490-9413-4a1f-95db-b62b2693a9c7/jvc_mini_dv_camcorder_manual.pdf
    • https://uploads.strikinglycdn.com/files/453d5c05-3eab-4a87-bd32-ba9596df741c/graco_modes_duo_double_stroller_-_duke.pdf
    • https://uploads.strikinglycdn.com/files/fe9cc8f8-c19c-42f1-9399-2d40402ad476/journey_to_the_west_2_movie_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/304a09f4-a805-4d27-a2cb-3e3ab9fd426b/zoom_5341j_specs.pdf
    • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_adc1bbbed5db43b386e5a280de0b286f.pdf?index=true
    • https://2ac56fc1-f7ee-4366-9cb2-1681469c68ee.filesusr.com/ugd/b914b5_a711071515524823a05546c3d437cc7f.pdf?index=true
    • https://13ea8442-998f-4f14-ba3b-7f37e53a414c.filesusr.com/ugd/008a9f_c43529539cd5488395cb7d0438b80bc8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f94cac78-440c-40ff-95eb-4784e5e0477b/la_divina_comedia_de_dante_alighieri_libro_completo.pdf
    • https://uploads.strikinglycdn.com/files/4af6a02c-0b7d-448e-a394-7cd753991f06/what_is_the_tale_of_the_three_brothers_based_on.pdf
    • https://uploads.strikinglycdn.com/files/5cd3dd52-4100-4a4d-aa60-2ccbe9b27dda/how_to_sync_remote_to_hunter_ceiling_fan.pdf
    • https://uploads.strikinglycdn.com/files/a3d14aef-5f77-4ce1-abf0-0af2ddcb1e5d/78082407343.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0001258a.bin
b742513cf0ba4ce2656264394452bd0c2cc5bd1ee4ac68273a0f04816c05d7e9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1258A 89028 bytes
font_01_sfnt_off00022f3e.bin
afaadaf81fb63b04a39f5fa62c5d3bc20c52b65ec0118684414ed88eab3cf88b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22F3E 4976 bytes
font_02_sfnt_off00024047.bin
003ec2ffadeca45385ecde66d16891d9de25d31faa91c8e77fcd307f8d9705c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24047 10660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.